Checksums for nightly builds

This fixes #1199

Also makes sure that the built-in Phar signature uses SHA-512.